Can solicitors use ChatGPT? Client confidentiality before any document goes into an AI tool

Short answer: Solicitors can use AI tools such as ChatGPT, but client information should only go into one where appropriate contractual, technical and organisational safeguards are in place. Without them, the SRA warns, confidentiality is likely to be breached and privilege may be lost for good.

by Margo Legal. Published . Operational guidance, not legal advice. Margo Legal is not a law firm.

by Margo Legal. Published .

Can solicitors use ChatGPT?

Yes, but not with client information unless appropriate safeguards are in place. The SRA does not ban AI tools; it says client information should only be entered into AI systems where appropriate contractual, technical and organisational safeguards protect confidentiality.

The SRA's Misuse of AI warning notice (17 August 2026) says firms have the freedom to use AI tools provided they meet the SRA's standards. Using a general AI tool for work that involves no client information, such as drafting an internal checklist from scratch, raises different questions from pasting in a client's contract. This guide deals with the second case. For what the notice says as a whole, and the firm-level steps it points to, see our guide to the SRA's AI warning notice.

Is it a breach of confidentiality to put client documents into ChatGPT?

It can be. The SRA warns that putting client information into public AI tools will likely breach client confidentiality, and that legal professional privilege may be permanently waived and unable to be recovered.

The notice relies on UK v Secretary of State for the Home Department [2026] UKUT 81 (IAC), where the Upper Tribunal observed at paragraph 21 that "to put client letters and decision letters from the Home Office into an open source AI tool, such as ChatGPT, is to place this information on the internet in the public domain". The SRA adds that, depending on the provider's terms, settings and technical architecture, information entered into AI systems may be stored, retained or used to improve the tool, and that this applies to both free and paid tools.

What does the SRA confidentiality duty require?

Paragraph 6.3 of the SRA Codes requires you to keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents. The SRA's guidance says the courts treat this duty as unqualified, not merely a duty to take reasonable steps.

The SRA's guidance on confidentiality of client information also says that information should not be passed to third parties without the client's consent, and that outsourcing, including storing data with a third party via the cloud, requires firms to consider the arrangements that protect clients' confidential information. It distinguishes confidentiality from legal professional privilege, which only the client can waive.

Does UK GDPR apply when client data goes into an AI tool?

Usually, yes. Most client files contain personal data, so the UK GDPR security principle applies: personal data must be processed with appropriate security, using appropriate technical or organisational measures.

Article 5(1)(f) of the UK GDPR sets the integrity and confidentiality principle, and Article 5(2) makes the controller responsible for, and able to demonstrate, compliance. Article 32 requires security appropriate to the risk. The Information Commission (formerly the ICO) says in its guide to data security that a controller must choose a processor that gives sufficient guarantees about its security measures.

What should the contract with an AI provider cover?

Where the provider processes personal data on your behalf, UK GDPR Article 28 requires a written contract. It must cover, among other things, processing only on your documented instructions, confidentiality of the provider's staff, security measures, sub-processors, and deletion or return of the data at the end.

Article 28(3) lists the terms in full, and Article 28(2) says a processor must not engage another processor without your prior written authorisation. These are the points to check in an AI provider's terms before client data goes in, alongside the SRA's own list: client data stays in a secure environment, is not accessed by unauthorised third parties, is not used to train models except where explicitly authorised, and is not kept longer than necessary. Our vendor data security questions turn these into questions to put to suppliers.

Do we need a DPIA before using AI on client files?

Possibly. UK GDPR Article 35 requires a data protection impact assessment before processing that is likely to result in a high risk to individuals, in particular processing using new technologies.

Whether your use crosses that threshold depends on the nature, scope, context and purposes of the processing. The Information Commission's DPIA guidance explains how to decide, including what it treats as innovative technology. Where you decide a DPIA is not needed, record why.

What should a small firm decide before anyone uses AI on client work?

Write down which tools are approved, which client information may go into them, and who checks the output. The SRA Code requires you to be able to justify your decisions and actions (paragraph 7.2).

A one-page position covering approved tools, permitted and banned uses, redaction rules and the person who approves exceptions is usually enough to start. This framing is ours, not a regulator's checklist.

SRA guidance on AI

Sources

Related: The SRA's AI warning notice: what small firms need to do · Vendor data security questions · Legal AI vendor terms index · Join the Margo waitlist

The rules Margo Legal works to.

Margo Legal works on one defined workflow at a time and keeps every source and assumption visible.

Read how we work
One clear piece of workRead moreEvidence boundaryRead moreTransparent assumptionsRead moreNo forced product routeRead moreMargo security statusRead more